GLPI Unauthorized API Access Vulnerability Allowing Knowledge Base Item Disclosure

A vulnerability exists in GLPI versions 9.1.0 prior to 10.0.21, allowing unauthorized users with API access to read all knowledge base entries. This issue arises from insufficient visibility restrictions, enabling access to knowledge base items that should be restricted.

Impact

Exploitation of this vulnerability allows unauthorized users to access and read knowledge base entries through the GLPI API, potentially leading to the disclosure of sensitive information.

Reproduction

To reproduce this vulnerability, an unauthorized user must send a request to the GLPI API while using a version of GLPI that is affected by this vulnerability (9.1.0 prior to 10.0.21). The absence of proper visibility restrictions will allow the user to access all knowledge base entries.

Remediation

Users should upgrade to GLPI version 10.0.21, where this vulnerability has been patched.